CERT-FR reports remote denial-of-service vulnerability in MongoDB PHP Driver, affecting 1.x, 2.1.x and 2.5.x branches
CERT-FR advisory CERTFR-2026-AVI-1347 reports a vulnerability in the MongoDB PHP Driver that lets an attacker cause a remote denial of service. The flaw is tracked in the MongoDB security bulletin PHPC-276, dated 19 October 2026. The advisory does not mention active exploitation, CVE identifiers, IOCs or attribution.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1347 reports a flaw in the MongoDB PHP Driver that lets an attacker cause a remote denial of service. No CVE, CVSS score, affected component, or required conditions (authentication, configuration, user interaction) are given. Affected versions are 1.x.x before 1.21.12, 2.1.x before 2.1.12 and 2.5.x before 2.5.5. Fixed versions are 1.21.12, 2.1.12 and 2.5.5 or later.
Como funciona
The sources do not describe how the vulnerable process works. They say only that a remote attacker can cause a denial of service. Which input reaches which part of the driver, and at which step it fails, has not been published in the material available.
Por que é vulnerável
The root cause is not stated in the advisory or in the story. The fix is available in the patched driver releases, but the sources do not say what it changes or why the flaw went unnoticed.
Como foi descoberta
CERT-FR published the advisory on 21 October 2026, pointing to the MongoDB security bulletin PHPC-276 dated 19 October 2026 as the source for fixes. The sources do not say who found the flaw or how it was reported. The advisory mentions no active exploitation, attribution or IOCs.
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:26.
Detalhes técnicos
- Affected: MongoDB PHP Driver 1.x.x before 1.21.12, 2.1.x before 2.1.12 and 2.5.x before 2.5.5.
- Impact: remote denial of service.
- The advisory gives no CVE, CVSS score, root cause or attack vector.
Remediação
- Consult the MongoDB security bulletin PHPC-276 (jira.mongodb.org/browse/PHPC-276) and upgrade to PHP Driver 1.21.12, 2.1.12, 2.5.5 or later, depending on the branch in use.
Linha do tempo
-
CERT-FR reports remote denial-of-service vulnerability in MongoDB PHP Driver, affecting 1.x, 2.1.x and 2.5.x branches
ler a análise desta fonte ocultar
CERT-FR advisory CERTFR-2026-AVI-1347 reports a vulnerability in the MongoDB PHP Driver that lets an attacker cause a remote denial of service. The flaw is tracked in the MongoDB security bulletin PHPC-276, dated 19 October 2026. The advisory does not mention active exploitation, CVE identifiers, IOCs or attribution.
Technical Details
- Affected: MongoDB PHP Driver 1.x.x before 1.21.12, 2.1.x before 2.1.12 and 2.5.x before 2.5.5.
- Impact: remote denial of service.
- The advisory gives no CVE, CVSS score, root cause or attack vector.
Remediation
- Consult the MongoDB security bulletin PHPC-276 (jira.mongodb.org/browse/PHPC-276) and upgrade to PHP Driver 1.21.12, 2.1.12, 2.5.5 or later, depending on the branch in use.